CVE-2010-0993

Pulse CMS disclosures (CVE-2010-0993) describe an unrestricted file upload in Pulse CMS Basic 1.2.2/1.2.3 and possibly Pulse Pro before 1.3.2. An authenticated user can upload a file with an executable extension and access it via a direct URL to the file in a web-root directory, allowing remote c...

CVE-2010-0992

Pulse CMS CSRF vulnerabilities (CVE-2010-0992) affect Pulse CMS Basic 1.2.2/1.2.3 and possibly Pulse Pro

CVE-2010-1298

Summary of CVE-2010-1298 : A directory traversal vulnerability exists in Pulse CMS 1.2.2, specifically in view.php, where an attacker can read arbitrary files by manipulating the f parameter in directory traversal sequences. The issue is documented across multiple sources (NVD, Red Hat, CVE List,...

CVE-2010-1334

Pulse CMS Basic 1.2.4 is affected by an Unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension and then accessing it via a direct request to the file in an unspecified di...

CVE-2010-0989

Pulse CMS contains a directory traversal vulnerability in delete.php (f parameter) affecting versions prior to 1.2.3. Exploitation allows remote authenticated users to delete arbitrary files on the server via directory traversal sequences. Severity is evidenced as moderately critical in Secunia’s...

CVE-2010-0988

CVE-2010-0988 affects Pulse CMS prior to 1.2.3. The issue comprises two related vulnerabilities: (1) an improper handling of login failures in includes/login.php that enables remote attackers to write arbitrary files and execute PHP code in the web root, and (2) an issue in viewing content where ...

CVE-2010-4330

CVE-2010-4330 describes a Local File Inclusion in Pulse CMS Basic prior to 1.2.9. The vulnerability exists in includes/controller.php, where a crafted value in the p parameter to index.php enables arbitrary local file inclusion (null-byte attack), allowing remote attackers to include and potentia...

CVE-2010-1080

CVE-2010-1080 is a confirmed XSS vulnerability in Pulse CMS 1.2.2, triggered via the f parameter in view.php, allowing remote injection of arbitrary script or HTML. The NVD lists a base score of 4.3 (Medium) with network attack vector and no confidentiality/availability impact, only partial integ...

CVE-2011-5041

Pulse Pro CMS 1.7.2 contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter in a blocks action and (2) post_id parameter in an edit-post action to index.php. The available connected documents corrobora...